Downloaded from MILITARY STANDARD MUNITION ROCKET AND MISSILE MOTOR IGNITION SYSTEM DESIGN, SAFETY CRITERIA FOR

Transcription

1 7 Downloaded from NOT MEASUREMENT 22 JANUARY 1992 MILITARY STANDARD MUNITION ROCKET AND MISSILE MOTOR IGNITION SYSTEM DESIGN, SAFETY CRITERIA FOR AMSC NIA FSC 13GP DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.

2 CONTENTS Paragraph SCOPE Scope Applicability Excluded munitions REFERENCED DOCUMENTS Government documents Orderofprecedence DEFINITIONS Sources and interpretation GENERAL REQUIREMENTS Ignition system design : Hazard analyses Ignition system Manual arming Ignition system safety failure rate Documentation Electromagnetic environments Electronic logic functions Fail-safe features Explosive ordnance disposal Armed or non-armed condition ~. 8 Design for quality control, inspection & maintenance Design approval Reviewing activity ,. 9 DETAILED REQUIREMENTS Application guidance Pyrotechnic trains NOTES Intended use Additional criteria Acquisition requirements Custodian of service-approvals for lead & booster explosives & pyrotechnic materials which are acceptable in-line prior to ignition system arming Hazard analyses : Subject term (key word) listing International standardization agreements S iii /

3 1.0 SCOPE 1.1 scode. systems used This standard establishes design safety criteria for ignition to arm and fire munition propulsion systems. 1.2 This standard applies to the design of ignition systems in new exploratory, advanced, engineering and operational system developments. Ignition systems incorporating one or more explosive components shall be subjected to the requirements of this standard in the same manner as those incorporating only pyrotechnic devices unless otherwise noted. 1.3 This standard does not apply to the following: a. Nuclear weapons systems and trainers. b. Flares and signals dispensed by hand held devices. c. Pyrotechnic countermeasure devices. 1

4 MIL-STD-1~ REFERENCED DOCUMENTS 2.1 ~ ~ons StandEuQs. The following specifications and standards form a part of this document to the extent specified herein. Unless otherwise specified, the issues of these documents are those listed in the issue of the Department of Defense Index of Specifications and Standards (DODISS) and supplement thereto, cited in the solicitation (see 6.3). SPECIFICATIONS MILITARY MIL-I MIL-P Initiators, Electric, Design and Evaluation of Pellets/Granules, Boron/Potassium Nitrate STANDARDS FEDERAL FED-STD-595 Color. MILITARY MIL-STD-331 Fuze and Fuze Components, Environmental and Performance Tests for. MIL-STD-444 Nomenclature Area. and Definitions in the Ammunition MIL-STD-461 Electromagnetic Interference Requirements for. Characteristics, MIL-STD-462 Electromagnetic Measurement of. Interference Characteristics, MIL-STD-882 MIL-STD-1316 MIL-STD-1385 MIL-STD-1512 System Safety Program Requirements. Fuze Design, Safety Criteria for. Preclusion of Ordnance Hazards in Electromagnetic Fields, General Requirements for. Electroexplosive Subsystems, Electrically Initiated,. Design Requirements and Test Methods. 2

5 MIL-STD-1751 Safety and Performance Tests for Qualification of Explosives MIL-STD-1757 Lightning Qualification Test Techniques for Aerospace Vehicles and Hardware. I DOD-STD-1795 Lightning Qualification of Aerospace Vehicles and Equipment. DOD-STD-2167 Defense System Software Development. DOD-STD-2169 High Altitude Electromagnetic Pulse (HEMP) Environment. (Unless otherwise indicated, copies of federal and military specifications, standards, and handbooks are available from the Naval Publications and Forms Center, (ATTN: NPODS), 5801 Tabor Avenuer Philadelphia PA ) ~. The following other Government documents form a part of this standard to the extent specified herein. Unless otherwise specified, the issues are those cited in the solicitation. ADA , Vol 4 Joint Services Safety and Performance Manual for Qualification of Explosives for Military Use. AFSC DH 1-6 Design Handbook, System Safety. NAVORD OD Weapon System Safety Guidelines Handbook. (Copies of specifications, standards, and other Government documents required by contractors in connection with specific acquisition functions should be obtained from the contracting activity or as directed by the contracting officer.) 2.2 ~. In the event of a conflict between the text of this standard and the references cited herein, the text of this standard shall take precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained. 3

6 3.0 DEFINITIONS 3.1 The definitions of MIL-STD-444 generally apply to -the ammunition terms used in this standard and the definitions of ADA , vol. 4 apply to the explosive terms. For interpretation of this standard, the following specific definitions apply: ~. An ignition system is armed when the output of a primary explosive, a sensitive pyrotechnic or a firing stimulus can produce ignition system function. a. ~ ignition system employing pyrotechnic train interruption (see 5.2.2) is considered armed when the interrupter(s) position (or condition) is ineffective in preventing propagation of the pyrotechnic train at a rate equal to or exceeding 0.5 percent at a confidence level of 95 percent. b. w ignition system employing a non-interrupted pyrotechnic train (see 5.2.3) is considered armed when the stimulus available for delivery to the initiator equals or exceeds the initiator s maximum no-fire stimulus.,,, ~a~ - The activation of the initiator in the pyrotechnic train by direct application of electrical energy The act of removing or activating one or more safety features which prevent arming, thus permitting arming to occur subsequently ~viro~. A specific physical condition to which the ignition system may be exposed ~viro~tal stlx@ldms. A specific stimulus obtained from an environment ~. A characteristic of an ignition system or part thereof designed to preclude ignition of the propulsion system or hazard to personnel when safety features malfunction ~. The combination of a hardware device and computer instructions or computer data that reside as read only software on the hardware device. The software cannot be readily modified under program control ~. A source of heat and pressure that actually ignites the motor propellant ~. The first component used in an explosive/pyrotechnic train ~on sa~tv device (ISD). A device whose purpose is to prevent an unintended functioning of the rocket or missile motor by interruption of the ignition train, interruption of the laser energy or disconnection of the operating circuit. 4

7 ~ Svstejn (IS). The aggregate of devices in a weapon system, including those in the munition, launcher and munition launch platform, which generate and control the operating signal to cause the rocket or missile motor to function. 3.I.12 ~. A safety feature is independent if its integrity is not affected by the functioning or malfunctioning of the other safety features tr~. A pyrotechnic train (see ) with elements of the train functionally separated until arming to interrupt the firing path and thus prevent ignition of the motor propellant in the event of unintended initiation of one of the elements upstream ~,, er. The activation of the initiator by laser energy ~. The sequence of events necessary for normal launch, that occurs between conunitting the system to launch and the time the system leaves the launcher or launch platform ~ no-fire SWUS (MNFS)._ The stimulus level at which the initiator will not fire or unsafely degrade with a probability of at a confidence level of 95 percent. Stimulus refers to the characteristic(s) such as current, rate of change of current (di/dt), power, voltage, or energy which is (are) most critical in defining the no-fire performance of the initiator. I Pvrote~. Those energetic materials or compounds which do not ordinarily detonate in their intended function but rather burn or deflagrate. Typical examples include boron potassium nitrate (BKN03), black powder, and many metal/oxidant combinations Pyrot~. The deflagration train beginning with the initiator and terminating in the motor propellant, For the purposes of this standard, the term pyrotechnic train is used also for those incorporating one or more detonating components in the train ~. An element or combination of elements that unintentional arming or functioning A failure of the ignition system to unintentional arming or functioning. prevents prevent Wtive D~. Sensitive pyrotechnics are used to initiate or ignite other, less sensitive, materials in the firing train. They are used in primers or squibs of ignition systems and are sensitive to ESD, heat, impact, or friction and undergo a rapid exothermic reaction upon initiation or. envlro~. A component or series of components designed to detect and respond to a specific environment. 5

8 4.0 GENERAL REQUIREMENTS 4.1 ~ The design of the ignition system shall take into account the aggregate of devices in the weapon system (munition, launcher, and munition launch platform) which generate and control the operating signal to cause the rocket or missile motor to function. 4.2 AMLYS_=. The following analyses shall be performed to identify hazardous conditions for the purpose of their elimination or control. a. A preliminary hazard analysis shall be conducted to identify and classify, per MIL-STD-882, hazards of normal and abnormal environments, as well as conditions and personnel actions that may occur in the phases before intentional arming of the IS. This analysis shall be used in the preparation of system design, test and evaluation requirements, and in combination with the system hazard analyses and detailed analyses (4.2.b) below, to determine the need to incorporate an Ignition Safety Device (ISD). An ISD shall be incorporated where the design of the pyrotechnic train dictates (see 5.2.2) or when its incorporation is necessary to meet the IS safety failure rate (see 4.5). b. System hazard analyses and detailed analyses, such as fault tree analyses, and failure mode effects and criticality analyses, shall be conducted to arrive at an estimate of the safety system failure rate and to identify any single point or credible failure modes. These analyses shall include an assessment of the relative sensitiveness of each component in the pyrotechnic train. c. For the IS containing an embedded microprocessor, controller or other computing device, the analyses shall include a determination of the contribution of the software (see 4.8) to the enabling of a safety feature. d. Where the software is shown to directly control or remove one or more safety features, a detailed analysis and testing of the applicable software shall be performed to assure that no design weaknesses, credible software failures, or credible hardware failures propagating through the software can result in compromise of the safety features. 4.3 ~. In order to preclude unintended ignition system arming or initiation, the ignition system shall: a. inhibit the arming sequence except as a consequence of a valid launch or confirmation of launch intent. b. not be susceptible to common-mode failures. c. not contain any initiation of the arming d. delay, based on initiation of the arming single-point failure mode prior to or at the cycle. the overall ignition system firing timeline, cycle within appropriate operational tolerances. 6

9 e. utilize environmental forces, whenever possible, to enable safety feature(s). When the IS utilizes stored energy to enable the safety feature(s), the stored energy source shall not be integral to the IS unless it can be demonstrated that it is impractical to do otherwise and that the required safety failure rate (see 4.5) can be achieved. 4.4 The ignition system shall not be capable of being armed manually unless such capability is required by operational conditions and is specifically approved by the responsible reviewing activity of Such systems shall be capable of being easily returned to a safe condition under the conditions of deployment. 4.5 ~on svstem stietv f~ rate. shall be calculated by performing a safety verified to the extent practicable by test requirement, the safety failure rate shall million prior to intentional initiation of The safety failure rate of the IS analysis (see 4.2) and shall be and analysis. As a minimum not exceed one failure in one the arming sequence. 4.6 at~on. The evaluation program used as the basis of the safety assessment which is prepared by the developing agency shall be documented in both detail and summary form. 4.7 envlro~. 1Ss, in their normal life cycle configurations, shall not inadvertently arm or function during and after exposure to: electromagnetic radiation (EMR), electrostatic discharge (ESD), electromagnetic pulse (EMP), electromagnetic interference (EMI), lightning effects (LE), or power supply transients (PST). In addition, 1Ss shall not exhibit unsafe operation during and after exposure to the above environments. 1Ss shall be tested or evaluated for: a. EMR - per MIL-STD-1385 and MIL-STD-1512 b. ESD - per MIL-STD-331 c. EMP - per DOD-STD-2169 d. EMI - per MIL-STD-461 and MIL-STD-462 e. LE - per DOD-STD-1795 and MIL-STD-1757 f. PST - per appropriate test and analysis 4.8. lo~. Any functions performed by the IS shall be Firmware devices shall not be erasable which the IS would otherwise survive. electronic logic related to safety embedded as firmware or hardware. or alterable by credible environments 4.9 ~e fea~. 1Ss shall incorporate fail-safe features based on munition requirements. 7

10 4.10 ve or~ce diswosti. The IS shall incorporate Explosive Ordnance Disposal (EOD) features which insure that, in the event of accidents, extreme/hostile situations, or dud ordnance; EOD personnel can either return the munition to a safe to handle condition or, where necessary, implement field expedient disposal.,, revlewlna au~. All new or altered designs, or new applica tions of existing designs shall be presented to the appropriate service s EOD research, development, test and evaluation (RDT&E) authority for technical advice and assistance in determining viable design approaches or trade-offs for EOD as follows: 4.11 a. For Army: Commander US Army ARDEC ATTN : SMCAR-FSM-E Picatinny Arsenal, NJ b. For Navy and Commanding Officer Marine Corps: Naval Explosive Ordnance Disposal Technology Center Code 60 Indian Head, MD c. For Air Force Commanding Officer ATTN : Detachment 63 AFLC LOC Indian Head, MD ~ more of the following:,,. The IS design shall incorporate one or a. A feature that prevents assembly of the IS in an armed condition. b. A feature that provides a positive means of determining that the IS is not armed during and after its assembly and during installation into the munition. c. A feature that prevents installation of an armed, munition. assembled IS into a If arming and reset of the assembled IS in tests is a normal procedure in manufacturing, inspection, or at any time prior to its installation into a munition, subparagraph a is not sufficient and either subparagraph b or c must also be met ~. If visual indication of the non-armed or armed condition is employed in the IS, visible indicators shall be designed to provide a positive, unambiguous indication of condition. Indicator failure shall not result in a false non-armed indication. If color coding is used to represent condition, the colors and coding shall be as follows: 8.

11 a. Non-armed condition. Fluorescent green background with the letter S or word SAFE superimposed thereon in white. Colors shall be nonsecular. b. with the shall be Armed condition. Fluorescent red or fluorescent orange background letter A or the nonsecular. word ARMED superimposed thereon in black. Colors c. Suggested color specification. 1) Fluorescent 2) Fluorescent 3) Fluorescent green, Color No per FED-STD-595 red, Color No per FED-STD-595 orange, Color No per FED-STD Where arming of the IS is recyclable, the armed IS shall return to the non-armed condition upon removal of the arming energy cal av. For electrically initiated pyrotechnic trains, the IS design shall include a feature to dissipate the firing energy whenever an armed IS is returned to the non-armed condition. The dissipation means shall be designed to prevent common mode failures. a. The IS shall be designed and documented to facilitate application of effective quality control and inspection procedures. Design characteristics critical to safety shall be identified to assure that the designed safety is maintained. b. The design of the IS shall facilitate the use of inspection and test equipment for monitoring all characteristics which assure the safety and intended functioning of the fuze at all appropriate stages. The IS design should facilitate the use of automatic inspection equipment. c. Embedded computing systems and their associated software (firmware) shall be designed and documented for ease of future maintenance. Software development shall be in accordance with accepted high quality software development procedures, such as DOD-.$TD ~ anwrov~. At the inception of engineering development, the developing activity should obtain approval from the cognizant safety authority of both the design concept and the methodology for assuring compliance with safety requirements. At the completion of engineering development, the developing activity shall present a safety assessment to the cognizant safety authority (see 4.14) for review to obtain approval of the design ~., actl~ New or altered designs, or new applications of approved designs shall be presented to the appropriate service safety review board for a safety evaluation and certification of compliance with this standard: 9.

12 a. Army : Commander US Army Missile Command ATTN : AMSMI-SF Redstone Arsenal, AL b. Navy: Chairman, Weapon System Explosives Safety Review Board US Naval Sea Systems Command Washington DC c. Air Force: USAF Nonnuclear Munitions Safety Board ATTN : AFDTC/SES Eglin Air Force Base FL

13 MIL-STD-l!IO1 5.1 ~on ~. The following detailed requirements. shall apply for specific IS designs ~vrotec~ or m~ltv ~vro~.,., ( a. Only pyrotechnic materials listed in Table I herein and those explosive materials listed in Table I of MIL-STD-1316 are approved by all services for use in a position leading to the initiation of a rocket or missile m@or without interruption. b. Approval by all services must be received by the Chairman, DOD Fuze Engineering Standardization Working Group (see 6.4) before a new material can be added to these tables or before a listed material can be deleted. Approved pyrotechnic and explosive materials shall be qualified in the IS and certified by the associated safety board of 4.14 as acceptable for that IS. c. The material used in 1Ss shall not be altered by any means (precipitation, recrystallization, grinding, density changes, etc.) likely to increase its sensitivity beyond that at which the material was qualified and at which it is customarily used, unless it is requalified. d. Pyrotechnic materials which do not appear in Table-I may be utilized physically in-line with the rocket motor prior to IS arming if:. (1) The material is qualified to MIL-STD-1751, as determined by testing, to the requirements of paragraph 5.4 therein, with the exception of paragraph 5.4.5, Hot Wire Ignition Testr or (2) For material that does not meet the test requirements of MIL-STD above, the material shall demonstrate, in comparative tests, sensitivity values equal to or less than Boron Potassium Nitrate (BKN03). BKN03 shall be tested alongside the proposed material to obtain the comparative values. Pvroteti TABLE I. roved Pvrote~ BKN03 MIL-P

14 ,, Pvrote~ nterrwtlorl. When the pyrotechnic train contains material(s) other than those allowed by 5.2.1, at least one interrupter (shutter, slider, rotor, for example) shall separate these materials from the balance of the pyrotechnic train until it is removed during ISD arming as a consequence of an intentional initiation of the launch sequence ds of res~. The interrupter(s) shall comply with one of the following methods of restraint. a. The interrupter(s) shall be directly locked mechanically in the safe position by at least one safety feature. The safety feature shall not be removed prior to intentional initiation of the arming sequence. b. The interrupter(s) shall be directly restrained mechanically in the safe position by at least one safety feature. The safety feature shall be overcome by the arming energy and shall automatically return the interrupter to a safe position upon removal of the arming energy.,, tion Dmtlorl. If the sensitive element is positioned such that safety is dependent upon the presence of an interrupter, the design shall include positive means to prevent the ISD from being assembled without the properly positioned interrupter. If the sensitive element is positioned such that omission of the interrupter will prohibit pyrotechnic train transfer, a single interrupter is acceptable Jaterrtion effectivenesxi. The effectiveness of interruption prior to initiation of the arming sequence shall be determined numerically in accordance with MIL-STD-331, Primary Explosive Component Safety Test or by similar methodologies. The results shall be presented and justified to the appropriate service safety authority ~ted Dvrotec~ic tlai,l-1 con= When the pyrotechnic train contains only those materials allowed by 5.2.1, no train interruption is required. Where pyrotechnic train interruption is not incorporated, function energy shall be controlled to preclude unintentional arming and firing. For ignition systems containing function energy prior to intentional arming, at least two energy interrupters, each controlled by an independent safety feature, shall prevent the flow of energy to the initiator until the intent to launch the munition is verified by the IS. Where the design includes energy interrupters, the IS shall not be capable of functioning in the absence of the interrupter(s). The combined probability of having function energy in the IS, having a failure of the energy control feature(s) and firing the initiator with the available function energy shall be compatible with the allowable IS safety system failure rate (see 4.5) ~tor electrical,,, se~vltv ~ted rwrote- trti. The initiator for an electrically fired non-interrupted train shall: 12

15 a. meet the appropriate characteristics listed for Class B initiators of MIL-I b. not exhibit unsafe degradation when tested in accordance with MIL-STD c. not be capable of being initiated by any electrical potential of less than 500 volts. Deflagration of the initiator is acceptable provided that initiator detonation is required to propagate the pyrotechnic train. d. Not be capable of being initiated by any electrical potential of less than 500 volts, when applied to any accessible part of the IS after installation into the munition or any munition subsystem Unless otherwise specified, the initiator for an electrically fired interrupted pyrotechnic train shall be qualified to therequirements listed for Class A initiators in MIL-I

16 6. NOTES This section contains information of a general or explanatory nature that may be helpful, but is not mandatory. 6.1 UwakLwe. This standard establishes specific design safety criteria for ignition systems and ignition safety devices.,, 6.2 ~. Individual services and service components may issue regulations or instructions which impose additional design safety criteria or add clarifying guidelines (e.g. U.S. Army Fuze Safety Review Board Guidelines for Evaluation of Electronic Safety & Arming Systems, WSESRB Technical Manual for Electronic Safety and Arming Devices with Non-Interrupted Explosive Trains). 6.3 ~ re~. Acquisition documents should specify the following: a. TITLE, NUMBER and DATE of this standard. b. Issue of DODISS to be cited in the solicitation and, if required, the specific issue of individual documents referenced (see and 2.1.2). 6.4 C?JStoa of service-~rovals for 1~ bo~ter e-~ves to,,, 101 x~tlon s- ikdl@z. Chairman DOD Fuze Engineering Standardization Working Group U.S. Army Armament Research, Development and Engineering Center Attn: SMCAR-AEF-C Picatinny Arsenal NJ ~. Techniques for conducting hazard analyses are described in NAVSEA OD44942, AFSC Design Handbook DH 1-6, and Nuc Reg lect,! term (kev word) llstlnq Arming, control Explosive ordnance disposal Explosive train Explosive train interruption Fail-safe Function, premature Fuze Fuze design, safety criteria for Ignition safety device Ignition system Pyrotechnic train Safety and arming device 14,

17 6.7 s~.,. Certain provisions of this standard are the subject of International Standardization Agreements (ASCC-AIR-STD-20/9, Design Safety Principles for Airborne Weapon Fuzing Systems, STANAG 4187, Fuzing Systems; Safety Design Requirements, and STANAG 3525, Design Safety Principles anood General Design Criteria for Airborne Weapon Fuzing Systems, and STANAG 4368, Electric and Laser Ig nition Systems for Rockets and Guided Missile Motors - Safety Design Requirements). When change notice, revision or cancellation of this document is proposed which affect or violate the international agreement concerned, the preparing activity will take appropriate reconciliation action through international standardization channels, including departmental standardization offices, if required. Custodians: Preparing Activity: Army-AR Army-A.R Navy-OS Air Force-n Review activities: Army-MI Navy-AS Air Force-18,99 Project 13GP

18 STANDARDIZATION DOCUMENT IMPROVEMENT PROPOSAL W TRUCTIONS 1. The preparing activity must complete blocks 1, 2, 3, and 8. In block 1, both the document number and revision letter should be given. 2. The submitter of this form must complete blocks 4, 5, 6, and The preparing activity must provide a reply within 30 days from receipt of the form. NOTE: This form may not be used to request copies of documents, nor to request waivers, or clarification of requirements on current contracts. Comments submitted on this form do not constitute or imply authorization to waive any portion of the referenced document(s) or to amend contractual requirements DOCUMENT NUMBER 2. DOCUMENT DATE (YYMMDD) 3. OOCUMENT TITLE MUNITION ROCKET AND MISSILE MOTOR IGNITION SYSTEM DESIGN, SAFETY CRITERIA FOR 4. NATURE OF CHANGE (Identify paragraph number and irdude proposed rewrite, If possible. Attach extra sheets if needed. ) 5. REASON FOR RECOMMENDATION...x...3.L..j>\..fw<.x.$.=.y...,.,,:,,..,...r..=..w.=.~ ~..:..,..,,.....*$...>..~..~+...#..>/.~.>~&~~...j...~.~..*~...f i...:.:.:.:.7..:.,,:.,..,..,..,..,.x.:.,:...,, ,..,,.,,..,.. ; ::::.:.: :.:,:.:.:.:.: :!;..:.:.:.:.~.,<.:+:<.:.:,.:.. """""""""""`""`"""""```"""``""'`"""""."...'... \ f... >,.:.:.:....< , ,...,.,,,,,:,X.,.,<,.,<.., :::,:,:,:.:...,,...,:.,..., ,-.*..-.y..:.,.../,,.....::..-.,......, ~p~-m~~:~gg;$~: PREPARING ACTIVITY ME US ARMY ARDEC STANDARDIZATIONOFFICE b. TELEPHONE (Include Area Code) )(%i~?%-6671 (2) AUTOVON :.ADDRESS (Include Zip Code) IF YOU DO NOT RECEIVE A REPLY WITHIN 4S DAYS, CONTACT: Defense Quality and Standardization Office ATTN: SMCAR-BAC-S 5203 Leesburg Pike, Suite 1403, Falls Church, VA SS Telephone (703) 7SS-2340 AUTOVON PICATINNY ARSENAL, NJ m A uu horm IJJLO, UL I UY rreuous eawons are ovsobxe i